Conversation
Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7...v8) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
github-actions
bot
added
needs-triage
Kusari Analysis Results:Caution Flagged Issues Detected The dependency analysis found no issues with pinned version changes. However, the code analysis identified 2 high-severity supply chain security risks in .github/workflows/landscape-sync.yaml. Both instances use actions/github-script@v8 (lines 74 and 138) with a mutable version tag rather than a pinned commit SHA. This is a recognized supply chain attack vector: a mutable tag can be silently redirected to a malicious commit without any visible change to the workflow file, meaning the repository would execute compromised code without warning. The risk is amplified in a CNCF automation repository context, where the workflow carries elevated permissions to create and manage GitHub issues. Action required: Replace both instances of actions/github-script@v8 with the full commit SHA corresponding to the intended release (e.g., actions/github-script@60a0d83 for v7, or the correct SHA for v8). This ensures the workflow is immutably pinned and cannot be tampered with via tag reassignment. Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsUnpinned action reference detected. The action 'actions/github-script@v8' must be pinned to a full commit SHA instead of a mutable version tag. Using a mutable tag allows the action to be silently updated or replaced, creating a supply chain attack vector.
Unpinned action reference detected. The action 'actions/github-script@v8' must be pinned to a full commit SHA instead of a mutable version tag. Using a mutable tag allows the action to be silently updated or replaced, creating a supply chain attack vector.
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
| - name: Create or update issue | ||
| if: steps.sync-check.outputs.has_missing == 'true' | ||
| uses: actions/github-script@v7 | ||
| uses: actions/github-script@v8 |
There was a problem hiding this comment.
Unpinned action reference detected. The action 'actions/github-script@v8' must be pinned to a full commit SHA instead of a mutable version tag. Using a mutable tag allows the action to be silently updated or replaced, creating a supply chain attack vector.
| - name: Close issue if no missing projects | ||
| if: steps.sync-check.outputs.has_missing == 'false' | ||
| uses: actions/github-script@v7 | ||
| uses: actions/github-script@v8 |
There was a problem hiding this comment.
Unpinned action reference detected. The action 'actions/github-script@v8' must be pinned to a full commit SHA instead of a mutable version tag. Using a mutable tag allows the action to be silently updated or replaced, creating a supply chain attack vector.
Bumps actions/github-script from 7 to 8.
Release notes
Sourced from actions/github-script's releases.
... (truncated)
Commits
ed59741Merge pull request #653 from actions/sneha-krip/readme-for-v82dc352eBold minimum Actions Runner version in README01e118cUpdate README for Node 24 runtime requirements8b222acApply suggestion from@salmanmkcadc0eeaREADME for updating actions/github-script from v7 to v820fe497Merge pull request #637 from actions/node24e7b7f22update licenses2c81ba0Update Node.js version support to 24.xDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)